mcp-mozilla-observatorySAFE
MDN HTTP Observatory — grade any website's HTTP security headers and get the specific fixes, from Mozilla's public scanner.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MDN HTTP Observatory — grade any website's HTTP security headers and get the specific fixes, from Mozilla's public scanner.
Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.
Tools
observatory_scan(host)— runs (or returns Mozilla's recent) scan and gives
the letter grade A+..F, the numeric score, and the pass/fail counts.
observatory_results(host, only_failures?, include_history?, history_limit?)—
all 12 tests with pass/fail, score impact, Mozilla's own remediation prose, the observed response headers, and the host's grade history.
observatory_grade_distribution()— how many scanned sites hold each grade,
so a single grade can be placed against the web at large.
Auth
Keyless.
Data sources
POST https://observatory-api.mdn.mozilla.net/api/v2/scan?host=— scan summary.GET https://observatory-api.mdn.mozilla.net/api/v2/analyze?host=— full detail.GET https://observatory-api.mdn.mozilla.net/api/v2/grade_distribution— histogram.
Things the next person would otherwise rediscover
- The detail endpoint is `/analyze`, not `/scan`.
GET /api/v2/scan?host=
is a 404 — /scan exists only as a POST. /api/v2/tests?scan= and /api/v2/scan/ are both 404 as well (all verified 2026-09-17). The histogram is grade_distribution with an underscore; the hyphenated spelling 404s.
- `tests_failed` and `pass: false` disagree, and both are right. Mozilla
counts only score-reducing failures in tests_failed, but sets pass: false on informational tests with a score_modifier of 0 too — mozilla.org on 2026-09-17 reported tests_failed: 2 with four tests marked not-passing. The pack returns a per-test penalized flag and a tests_failing_with_score_impact count rather than dropping the zero-impact rows, so only_failures returning more rows than tests_failed is expected and explained in the payload. -
5b7342abb5a7OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-mozilla-observatory -- npx -y @pipeworx/[email protected]
{
"mcpServers": {
"mcp-mozilla-observatory": {
"command": "npx",
"args": [
"-y",
"@pipeworx/[email protected]"
]
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
observatory_grade_distribution | read | Grade distribution across every site the MDN HTTP Observatory has scanned — how many sites hold each grade from A+ to F. Use it to say where one site\ |
observatory_results | read | Get the full MDN HTTP Observatory breakdown for a host: every one of the 12 security tests with pass/fail, the score impact, Mozilla\ |
observatory_scan | read | Scan a website\ |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
5b7342abb5a7full audit observations/trust-audit/mcp-server/pipeworx-io__mcp-mozilla-observatory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5b7342abb5a7 | SAFE | B | 89 | first audit |
Questions
What is the mcp-mozilla-observatory MCP server?
MDN HTTP Observatory — grade any website's HTTP security headers and get the specific fixes, from Mozilla's public scanner.
What tools does mcp-mozilla-observatory expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-mozilla-observatory safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-mozilla-observatory need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-mozilla-observatory run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-mozilla-observatory at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (5b7342abb5a7), read on 2026-10-11. The repository is watched and re-audited when it changes.